tim/xxx
1
0
Fork 0
Code Issues Pull Requests Releases Activity

Escape request and database values in forms and links.

Browse Source 
Add form_value() in html.lib.php.
This commit is contained in:
tim
2026-09-25 21:36:27 +02:00
parent 00e1829f8b
commit f6bdf10228
9 changed files with 37 additions and 29 deletions
Download Patch File Download Diff File Expand all files Collapse all files
publish/write.inc.php
+10 -10
View File
@@ -3,7 +3,7 @@ $id = get_id();
$search = get_search_args();
if ($action == 'preview')
$result = get_post_data(TRUE, TRUE);
$result = get_post_data(TRUE);
else if ($action && is_numeric($id))
$result = get_query($id);
if (isset($result) && is_array($result))
@@ -26,19 +26,19 @@ if (count($validate) !== 0) {
<label<?= isset($validate['title']) ? ' class="red"' : '' ?> for="title">Title:</label>
<div class="rightcolumn">
<input type="text" id="title" name="title" maxlength="150" value="<?= isset($title) ? $title : '' ?>" />
<input type="text" id="title" name="title" maxlength="150" value="<?= isset($title) ? form_value($title) : '' ?>" />
<span class="required">&nbsp;*</span>
</div>
<label<?= isset($validate['author']) ? ' class="red"' : '' ?> for="author">Author:</label>
<div class="rightcolumn">
<input type="text" name="author" id="author" value="<?= isset($author) ? $author : '' ?>" maxlength="150" />
<input type="text" name="author" id="author" value="<?= isset($author) ? form_value($author) : '' ?>" maxlength="150" />
<span class="required">&nbsp;*</span>
</div>
<label<?= isset($validate['email']) ? ' class="red"' : '' ?> for="email">Email address:</label>
<div class="rightcolumn">
<input type="text" name="email" id="email" maxlength="150" value="<?= isset($email) ? $email : ''?>" />
<input type="text" name="email" id="email" maxlength="150" value="<?= isset($email) ? form_value($email) : '' ?>" />
</div>
<div class="leftcolumn"></div>
@@ -52,7 +52,7 @@ if (count($validate) !== 0) {
<div class="textarea rightcolumn">
<div id="textparent">
<textarea name="story" id="story" rows="20" cols="50"><?php
echo (isset($story) ? $story : '')
echo (isset($story) ? form_value($story) : '')
?></textarea>
<div class="note">(To get line-breaks&mdash;as in poetry&mdash;instead of paragraph breaks, hit shift-enter instead of enter.)</div>
</div>
@@ -62,7 +62,7 @@ if (isset($file_src) || isset($img)) {
if (isset($file_src)) {
echo ' <input type="hidden" id="uploaded" name="uploaded" value="pending" />';
} else {
echo ' <input type="hidden" id="uploaded" name="uploaded" value="'.$id.'" />';
echo ' <input type="hidden" id="uploaded" name="uploaded" value="'.(int)$id.'" />';
}
echo ' <div class="in-note">If you are happy with the image above, click Submit. Otherwise, upload a new image:</div>';
} else {
@@ -89,16 +89,16 @@ if (isset($file_src) || isset($img)) {
<?php if ($is_admin) { ?>
<label<?php isset($validate['comments']) ? ' class="red"' : '' ?> for="comments">Comments:</label>
<div class="rightcolumn">
<input type="text" name="comments" id="comments" maxlength="150" value="<?= isset($comments) ? $comments : '' ?>" />
<input type="text" name="comments" id="comments" maxlength="150" value="<?= isset($comments) ? form_value($comments) : '' ?>" />
</div>
<input type="hidden" id="editor" name="editor" value="<?= $username ?>" />
<input type="hidden" id="editor" name="editor" value="<?= form_value($username) ?>" />
<?php } else { ?>
<input type="hidden" id="editor" name="editor" value="original author" />
<?php } ?>
<div style="display: none;">
<input type="hidden" id="date" name="date" value="<?= isset($date) ? $date : '' ?>" />
<input type="hidden" id="id" name="id" value="<?= isset($id) ? $id : '' ?>" />
<input type="hidden" id="date" name="date" value="<?= isset($date) ? form_value($date) : '' ?>" />
<input type="hidden" id="id" name="id" value="<?= isset($id) ? form_value($id) : '' ?>" />
</div>
<?php